huntback / loot
Loot index
When something attacks our decoys, huntback scans the source back and archives what its open directories and staging panels serve: webshells, phishing kits, exploit scripts, C2 configs and miners. This is the public index of those hosts.
5,965
hosts
106,472
files
103
new hosts in 24h
What this page answers
What do attackers keep on their own servers?
SourceServers that attacked our decoys, scanned back
Public hereCounts, labels, file types
Behind sign-inFiles, hashes, one zip per host
Hosts labelled gafgyt
| Host | Labels | File types | Files | Last seen |
|---|---|---|---|---|
| 43.129.51.137 Indonesia · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | PY, MD, LOG, JSON | 115 | 2026-09-30 |
| 49.234.49.58 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret malware gafgyt exploit | JSON, PY, SH, DB | 63 | 2026-09-30 |
| 118.25.25.81 China · Shenzhen Tencent Computer Systems Company Limited | exposed-secret exploit malware gafgyt | PY, MD, LOG, SH | 107 | 2026-09-30 |
| 84.32.34.6 The Netherlands · UAB Cherry Servers | malware exposed-secret mozi exploit | PY, GZ, TXT, BAK | 55 | 2026-09-30 |
| 190.183.251.210 Argentina · Gigared S.A. | exploit exposed-secret malware gafgyt | MD, PY, JSON, SQLITE | 30 | 2026-09-30 |
| 176.65.148.59 The Netherlands · Pfcloud UG (haftungsbeschrankt) | exposed-secret exploit malware mozi | SH, MD, LOG, PY | 88 | 2026-09-30 |
← NewerPage 2 of 2
Open the files, hashes and zips
Pivot across IPs, domains, certificates, JARM fingerprints and exposed open directories, backed by our own sensor network. Free tier, no card required.
Start hunting free